CVE-2026-64038
Received Received - Intake

Use-After-Free in Linux Kernel hwmon lm90 Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (lm90) Stop work before releasing hwmon device Sashiko reports: In lm90_probe(), the devm action to cancel the alert_work and report_work (lm90_restore_conf) is registered in lm90_init_client() before devm_hwmon_device_register_with_info() is called. Because devm executes cleanup actions in reverse order during module unbind or probe failure, the hwmon device is unregistered and freed first. If lm90_alert_work() or lm90_report_alarms() runs in the window between the hwmon device being freed and the delayed works being cancelled, lm90_update_alarms() will dereference the freed data->hwmon_dev here. Fix the problem by canceling the workers separately after registering the hwmon device and before registering the interrupt handler. This ensures that the workers are canceled after interrupts are disabled and before the hwmon device is released. Add "shutdown" flag to indicate that device shutdown is in progress to prevent workers from being re-armed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64038
EUVD
EUVD-2026-45611

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's hwmon subsystem, specifically in the lm90 driver. The issue occurs when the hwmon device is freed before the delayed work items (alert_work and report_work) are canceled. If these work items run after the device is freed, they may attempt to access freed memory, leading to a crash or potential code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's hwmon subsystem (lm90 driver) and requires kernel-level detection. It cannot be detected via standard network commands. Check kernel logs for hwmon-related errors or crashes using: dmesg | grep lm90. If the system uses the affected driver, kernel oops or panic messages may indicate exploitation.

Impact Analysis

If exploited, this vulnerability could cause system instability, crashes, or unexpected behavior in systems using the lm90 hardware monitoring driver. It may lead to denial-of-service conditions or, in rare cases, privilege escalation if combined with other vulnerabilities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory safety issue in the Linux kernel's hwmon subsystem. Compliance impacts would depend on system-specific implementations and whether the vulnerability leads to data exposure or integrity issues.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, disable the lm90 driver module (rmmod lm90) as a temporary workaround. Monitor system stability and apply kernel updates promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart